1 |
|
|
/* $OpenBSD: pfkdump.c,v 1.46 2017/04/19 15:59:38 bluhm Exp $ */ |
2 |
|
|
|
3 |
|
|
/* |
4 |
|
|
* Copyright (c) 2003 Markus Friedl. All rights reserved. |
5 |
|
|
* |
6 |
|
|
* Redistribution and use in source and binary forms, with or without |
7 |
|
|
* modification, are permitted provided that the following conditions |
8 |
|
|
* are met: |
9 |
|
|
* 1. Redistributions of source code must retain the above copyright |
10 |
|
|
* notice, this list of conditions and the following disclaimer. |
11 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
12 |
|
|
* notice, this list of conditions and the following disclaimer in the |
13 |
|
|
* documentation and/or other materials provided with the distribution. |
14 |
|
|
* |
15 |
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
16 |
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
17 |
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
18 |
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
19 |
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
20 |
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
21 |
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
22 |
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
23 |
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
24 |
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
25 |
|
|
*/ |
26 |
|
|
|
27 |
|
|
#include <sys/socket.h> |
28 |
|
|
#include <sys/time.h> |
29 |
|
|
#include <sys/sysctl.h> |
30 |
|
|
#include <net/pfkeyv2.h> |
31 |
|
|
#include <netinet/ip_ipsp.h> |
32 |
|
|
#include <netdb.h> |
33 |
|
|
#include <string.h> |
34 |
|
|
#include <unistd.h> |
35 |
|
|
#include <stdlib.h> |
36 |
|
|
#include <stdio.h> |
37 |
|
|
#include <err.h> |
38 |
|
|
#include <errno.h> |
39 |
|
|
|
40 |
|
|
#include "ipsecctl.h" |
41 |
|
|
#include "pfkey.h" |
42 |
|
|
|
43 |
|
|
static void print_proto(struct sadb_ext *, struct sadb_msg *); |
44 |
|
|
static void print_flow(struct sadb_ext *, struct sadb_msg *); |
45 |
|
|
static void print_supp(struct sadb_ext *, struct sadb_msg *); |
46 |
|
|
static void print_prop(struct sadb_ext *, struct sadb_msg *); |
47 |
|
|
static void print_sens(struct sadb_ext *, struct sadb_msg *); |
48 |
|
|
static void print_spir(struct sadb_ext *, struct sadb_msg *); |
49 |
|
|
static void print_policy(struct sadb_ext *, struct sadb_msg *); |
50 |
|
|
static void print_sa(struct sadb_ext *, struct sadb_msg *); |
51 |
|
|
static void print_addr(struct sadb_ext *, struct sadb_msg *); |
52 |
|
|
static void print_key(struct sadb_ext *, struct sadb_msg *); |
53 |
|
|
static void print_life(struct sadb_ext *, struct sadb_msg *); |
54 |
|
|
static void print_ident(struct sadb_ext *, struct sadb_msg *); |
55 |
|
|
static void print_udpenc(struct sadb_ext *, struct sadb_msg *); |
56 |
|
|
static void print_tag(struct sadb_ext *, struct sadb_msg *); |
57 |
|
|
static void print_tap(struct sadb_ext *, struct sadb_msg *); |
58 |
|
|
static void print_satype(struct sadb_ext *, struct sadb_msg *); |
59 |
|
|
|
60 |
|
|
static struct idname *lookup(struct idname *, u_int32_t); |
61 |
|
|
static char *lookup_name(struct idname *, u_int32_t); |
62 |
|
|
static void print_ext(struct sadb_ext *, struct sadb_msg *); |
63 |
|
|
|
64 |
|
|
void pfkey_print_raw(u_int8_t *, ssize_t); |
65 |
|
|
static char *print_flags(uint32_t); |
66 |
|
|
|
67 |
|
|
struct sadb_ext *extensions[SADB_EXT_MAX + 1]; |
68 |
|
|
|
69 |
|
|
struct idname { |
70 |
|
|
u_int32_t id; |
71 |
|
|
char *name; |
72 |
|
|
void (*func)(struct sadb_ext *, struct sadb_msg *); |
73 |
|
|
}; |
74 |
|
|
|
75 |
|
|
struct idname ext_types[] = { |
76 |
|
|
{ SADB_EXT_RESERVED, "reserved", NULL }, |
77 |
|
|
{ SADB_EXT_SA, "sa", print_sa }, |
78 |
|
|
{ SADB_EXT_LIFETIME_CURRENT, "lifetime_cur", print_life }, |
79 |
|
|
{ SADB_EXT_LIFETIME_HARD, "lifetime_hard", print_life }, |
80 |
|
|
{ SADB_EXT_LIFETIME_SOFT, "lifetime_soft", print_life }, |
81 |
|
|
{ SADB_EXT_ADDRESS_SRC, "address_src", print_addr }, |
82 |
|
|
{ SADB_EXT_ADDRESS_DST, "address_dst", print_addr }, |
83 |
|
|
{ SADB_EXT_ADDRESS_PROXY, "address_proxy", print_addr }, |
84 |
|
|
{ SADB_EXT_KEY_AUTH, "key_auth", print_key }, |
85 |
|
|
{ SADB_EXT_KEY_ENCRYPT, "key_encrypt", print_key }, |
86 |
|
|
{ SADB_EXT_IDENTITY_SRC, "identity_src", print_ident }, |
87 |
|
|
{ SADB_EXT_IDENTITY_DST, "identity_dst", print_ident }, |
88 |
|
|
{ SADB_EXT_SENSITIVITY, "sensitivity", print_sens }, |
89 |
|
|
{ SADB_EXT_PROPOSAL, "proposal", print_prop }, |
90 |
|
|
{ SADB_EXT_SUPPORTED_AUTH, "supported_auth", print_supp }, |
91 |
|
|
{ SADB_EXT_SUPPORTED_ENCRYPT, "supported_encrypt", print_supp }, |
92 |
|
|
{ SADB_EXT_SPIRANGE, "spirange", print_spir }, |
93 |
|
|
{ SADB_X_EXT_SRC_MASK, "src_mask", print_addr }, |
94 |
|
|
{ SADB_X_EXT_DST_MASK, "dst_mask", print_addr }, |
95 |
|
|
{ SADB_X_EXT_PROTOCOL, "protocol", print_proto }, |
96 |
|
|
{ SADB_X_EXT_FLOW_TYPE, "flow_type", print_flow }, |
97 |
|
|
{ SADB_X_EXT_SRC_FLOW, "src_flow", print_addr }, |
98 |
|
|
{ SADB_X_EXT_DST_FLOW, "dst_flow", print_addr }, |
99 |
|
|
{ SADB_X_EXT_SA2, "sa2", print_sa }, |
100 |
|
|
{ SADB_X_EXT_DST2, "dst2", print_addr }, |
101 |
|
|
{ SADB_X_EXT_POLICY, "policy", print_policy }, |
102 |
|
|
{ SADB_X_EXT_SUPPORTED_COMP, "supported_comp", print_supp }, |
103 |
|
|
{ SADB_X_EXT_UDPENCAP, "udpencap", print_udpenc }, |
104 |
|
|
{ SADB_X_EXT_LIFETIME_LASTUSE, "lifetime_lastuse", print_life }, |
105 |
|
|
{ SADB_X_EXT_TAG, "tag", print_tag }, |
106 |
|
|
{ SADB_X_EXT_TAP, "tap", print_tap }, |
107 |
|
|
{ SADB_X_EXT_SATYPE2, "satype2", print_satype }, |
108 |
|
|
{ 0, NULL, NULL } |
109 |
|
|
}; |
110 |
|
|
|
111 |
|
|
struct idname msg_types[] = { |
112 |
|
|
{ SADB_ACQUIRE, "sadb_acquire", NULL }, |
113 |
|
|
{ SADB_ADD, "sadb_add", NULL }, |
114 |
|
|
{ SADB_DELETE, "sadb_delete", NULL }, |
115 |
|
|
{ SADB_DUMP, "sadb_dump", NULL }, |
116 |
|
|
{ SADB_EXPIRE, "sadb_expire", NULL }, |
117 |
|
|
{ SADB_FLUSH, "sadb_flush", NULL }, |
118 |
|
|
{ SADB_GET, "sadb_get", NULL }, |
119 |
|
|
{ SADB_GETSPI, "sadb_getspi", NULL }, |
120 |
|
|
{ SADB_REGISTER, "sadb_register", NULL }, |
121 |
|
|
{ SADB_UPDATE, "sadb_update", NULL }, |
122 |
|
|
{ SADB_X_ADDFLOW, "sadb_addflow", NULL }, |
123 |
|
|
{ SADB_X_ASKPOLICY, "sadb_askpolicy", NULL }, |
124 |
|
|
{ SADB_X_DELFLOW, "sadb_delflow", NULL }, |
125 |
|
|
{ SADB_X_GRPSPIS, "sadb_grpspis", NULL }, |
126 |
|
|
{ SADB_X_PROMISC, "sadb_promisc", NULL }, |
127 |
|
|
{ 0, NULL, NULL }, |
128 |
|
|
}; |
129 |
|
|
|
130 |
|
|
struct idname sa_types[] = { |
131 |
|
|
{ SADB_SATYPE_UNSPEC, "unspec", NULL }, |
132 |
|
|
{ SADB_SATYPE_AH, "ah", NULL }, |
133 |
|
|
{ SADB_SATYPE_ESP, "esp", NULL }, |
134 |
|
|
{ SADB_SATYPE_RSVP, "rsvp", NULL }, |
135 |
|
|
{ SADB_SATYPE_OSPFV2, "ospfv2", NULL }, |
136 |
|
|
{ SADB_SATYPE_RIPV2, "ripv2", NULL }, |
137 |
|
|
{ SADB_SATYPE_MIP, "mip", NULL }, |
138 |
|
|
{ SADB_X_SATYPE_IPIP, "ipip", NULL }, |
139 |
|
|
{ SADB_X_SATYPE_TCPSIGNATURE, "tcpmd5", NULL }, |
140 |
|
|
{ SADB_X_SATYPE_IPCOMP, "ipcomp", NULL }, |
141 |
|
|
{ 0, NULL, NULL } |
142 |
|
|
}; |
143 |
|
|
|
144 |
|
|
struct idname auth_types[] = { |
145 |
|
|
{ SADB_AALG_NONE, "none", NULL }, |
146 |
|
|
{ SADB_AALG_MD5HMAC, "hmac-md5", NULL }, |
147 |
|
|
{ SADB_X_AALG_RIPEMD160HMAC, "hmac-ripemd160", NULL }, |
148 |
|
|
{ SADB_AALG_SHA1HMAC, "hmac-sha1", NULL }, |
149 |
|
|
{ SADB_X_AALG_SHA2_256, "hmac-sha2-256", NULL }, |
150 |
|
|
{ SADB_X_AALG_SHA2_384, "hmac-sha2-384", NULL }, |
151 |
|
|
{ SADB_X_AALG_SHA2_512, "hmac-sha2-512", NULL }, |
152 |
|
|
{ SADB_X_AALG_AES128GMAC, "gmac-aes-128", NULL }, |
153 |
|
|
{ SADB_X_AALG_AES192GMAC, "gmac-aes-192", NULL }, |
154 |
|
|
{ SADB_X_AALG_AES256GMAC, "gmac-aes-256", NULL }, |
155 |
|
|
{ SADB_X_AALG_CHACHA20POLY1305, "chacha20-poly1305", NULL }, |
156 |
|
|
{ 0, NULL, NULL } |
157 |
|
|
}; |
158 |
|
|
|
159 |
|
|
struct idname enc_types[] = { |
160 |
|
|
{ SADB_EALG_NONE, "none", NULL }, |
161 |
|
|
{ SADB_EALG_3DESCBC, "3des-cbc", NULL }, |
162 |
|
|
{ SADB_X_EALG_AES, "aes", NULL }, |
163 |
|
|
{ SADB_X_EALG_AESCTR, "aesctr", NULL }, |
164 |
|
|
{ SADB_X_EALG_AESGCM16, "aes-gcm", NULL }, |
165 |
|
|
{ SADB_X_EALG_AESGMAC, "aes-gmac", NULL }, |
166 |
|
|
{ SADB_X_EALG_BLF, "blowfish", NULL }, |
167 |
|
|
{ SADB_X_EALG_CAST, "cast128", NULL }, |
168 |
|
|
{ SADB_EALG_NULL, "null", NULL }, |
169 |
|
|
{ SADB_X_EALG_CHACHA20POLY1305, "chacha20-poly1305", NULL }, |
170 |
|
|
{ 0, NULL, NULL } |
171 |
|
|
}; |
172 |
|
|
|
173 |
|
|
struct idname comp_types[] = { |
174 |
|
|
{ SADB_X_CALG_NONE, "none", NULL }, |
175 |
|
|
{ SADB_X_CALG_OUI, "oui", NULL }, |
176 |
|
|
{ SADB_X_CALG_DEFLATE, "deflate", NULL }, |
177 |
|
|
{ SADB_X_CALG_LZS, "lzs", NULL }, |
178 |
|
|
{ 0, NULL, NULL } |
179 |
|
|
}; |
180 |
|
|
|
181 |
|
|
struct idname flag_types[] = { |
182 |
|
|
{ SADB_SAFLAGS_PFS, "pfs", NULL }, |
183 |
|
|
{ SADB_X_SAFLAGS_TUNNEL, "tunnel", NULL }, |
184 |
|
|
{ SADB_X_SAFLAGS_CHAINDEL, "chaindel", NULL }, |
185 |
|
|
{ SADB_X_SAFLAGS_UDPENCAP, "udpencap", NULL }, |
186 |
|
|
{ SADB_X_SAFLAGS_ESN, "esn", NULL }, |
187 |
|
|
{ 0, NULL, NULL } |
188 |
|
|
}; |
189 |
|
|
|
190 |
|
|
struct idname identity_types[] = { |
191 |
|
|
{ SADB_IDENTTYPE_RESERVED, "reserved", NULL }, |
192 |
|
|
{ SADB_IDENTTYPE_PREFIX, "prefix", NULL }, |
193 |
|
|
{ SADB_IDENTTYPE_FQDN, "fqdn", NULL }, |
194 |
|
|
{ SADB_IDENTTYPE_USERFQDN, "ufqdn", NULL }, |
195 |
|
|
{ 0, NULL, NULL } |
196 |
|
|
}; |
197 |
|
|
|
198 |
|
|
struct idname flow_types[] = { |
199 |
|
|
{ SADB_X_FLOW_TYPE_USE, "use", NULL }, |
200 |
|
|
{ SADB_X_FLOW_TYPE_ACQUIRE, "acquire", NULL }, |
201 |
|
|
{ SADB_X_FLOW_TYPE_REQUIRE, "require", NULL }, |
202 |
|
|
{ SADB_X_FLOW_TYPE_BYPASS, "bypass", NULL }, |
203 |
|
|
{ SADB_X_FLOW_TYPE_DENY, "deny", NULL }, |
204 |
|
|
{ SADB_X_FLOW_TYPE_DONTACQ, "dontacq", NULL }, |
205 |
|
|
{ 0, NULL, NULL } |
206 |
|
|
}; |
207 |
|
|
|
208 |
|
|
struct idname states[] = { |
209 |
|
|
{ SADB_SASTATE_LARVAL, "larval", NULL }, |
210 |
|
|
{ SADB_SASTATE_MATURE, "mature", NULL }, |
211 |
|
|
{ SADB_SASTATE_DYING, "dying", NULL }, |
212 |
|
|
{ SADB_SASTATE_DEAD, "dead", NULL }, |
213 |
|
|
{ 0, NULL, NULL } |
214 |
|
|
}; |
215 |
|
|
|
216 |
|
|
static struct idname * |
217 |
|
|
lookup(struct idname *tab, u_int32_t id) |
218 |
|
|
{ |
219 |
|
|
struct idname *entry; |
220 |
|
|
|
221 |
|
|
for (entry = tab; entry->name; entry++) |
222 |
|
|
if (entry->id == id) |
223 |
|
|
return (entry); |
224 |
|
|
return (NULL); |
225 |
|
|
} |
226 |
|
|
|
227 |
|
|
static char * |
228 |
|
|
lookup_name(struct idname *tab, u_int32_t id) |
229 |
|
|
{ |
230 |
|
|
struct idname *entry; |
231 |
|
|
|
232 |
|
|
entry = lookup(tab, id); |
233 |
|
|
return (entry ? entry->name : "unknown"); |
234 |
|
|
} |
235 |
|
|
|
236 |
|
|
static void |
237 |
|
|
print_ext(struct sadb_ext *ext, struct sadb_msg *msg) |
238 |
|
|
{ |
239 |
|
|
struct idname *entry; |
240 |
|
|
|
241 |
|
|
if ((entry = lookup(ext_types, ext->sadb_ext_type)) == NULL) { |
242 |
|
|
printf("unknown ext: type %u len %u\n", |
243 |
|
|
ext->sadb_ext_type, ext->sadb_ext_len); |
244 |
|
|
return; |
245 |
|
|
} |
246 |
|
|
printf("\t%s: ", entry->name); |
247 |
|
|
if (entry->func != NULL) |
248 |
|
|
(*entry->func)(ext, msg); |
249 |
|
|
else |
250 |
|
|
printf("type %u len %u", |
251 |
|
|
ext->sadb_ext_type, ext->sadb_ext_len); |
252 |
|
|
printf("\n"); |
253 |
|
|
} |
254 |
|
|
|
255 |
|
|
static char * |
256 |
|
|
print_flags(uint32_t flags) |
257 |
|
|
{ |
258 |
|
|
static char fstr[80]; |
259 |
|
|
struct idname *entry; |
260 |
|
|
size_t len; |
261 |
|
|
int i, comma = 0, n; |
262 |
|
|
|
263 |
|
|
len = snprintf(fstr, sizeof(fstr), "%#x<", flags); |
264 |
|
|
if (len >= sizeof(fstr)) |
265 |
|
|
return (NULL); |
266 |
|
|
for (i = 0; i < 32; i++) { |
267 |
|
|
if ((flags & (1 << i)) == 0 || |
268 |
|
|
(entry = lookup(flag_types, 1 << i)) == NULL) |
269 |
|
|
continue; |
270 |
|
|
n = snprintf(fstr + len, sizeof(fstr) - len - 1, |
271 |
|
|
comma ? ",%s" : "%s", entry->name); |
272 |
|
|
if ((size_t)n >= sizeof(fstr) - len - 1) |
273 |
|
|
return (NULL); |
274 |
|
|
len += n; |
275 |
|
|
comma = 1; |
276 |
|
|
} |
277 |
|
|
strlcat(fstr, ">", sizeof(fstr)); |
278 |
|
|
|
279 |
|
|
return (fstr); |
280 |
|
|
} |
281 |
|
|
|
282 |
|
|
static void |
283 |
|
|
print_sa(struct sadb_ext *ext, struct sadb_msg *msg) |
284 |
|
|
{ |
285 |
|
|
struct sadb_sa *sa = (struct sadb_sa *)ext; |
286 |
|
|
|
287 |
|
|
if (msg->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) |
288 |
|
|
printf("cpi 0x%8.8x comp %s\n", |
289 |
|
|
ntohl(sa->sadb_sa_spi), |
290 |
|
|
lookup_name(comp_types, sa->sadb_sa_encrypt)); |
291 |
|
|
else |
292 |
|
|
printf("spi 0x%8.8x auth %s enc %s\n", |
293 |
|
|
ntohl(sa->sadb_sa_spi), |
294 |
|
|
lookup_name(auth_types, sa->sadb_sa_auth), |
295 |
|
|
lookup_name(enc_types, sa->sadb_sa_encrypt)); |
296 |
|
|
printf("\t\tstate %s replay %u flags %s", |
297 |
|
|
lookup_name(states, sa->sadb_sa_state), |
298 |
|
|
sa->sadb_sa_replay, print_flags(sa->sadb_sa_flags)); |
299 |
|
|
} |
300 |
|
|
|
301 |
|
|
/* ARGSUSED1 */ |
302 |
|
|
static void |
303 |
|
|
print_addr(struct sadb_ext *ext, struct sadb_msg *msg) |
304 |
|
|
{ |
305 |
|
|
struct sadb_address *addr = (struct sadb_address *)ext; |
306 |
|
|
struct sockaddr *sa; |
307 |
|
|
struct sockaddr_in *sin4; |
308 |
|
|
struct sockaddr_in6 *sin6; |
309 |
|
|
char hbuf[NI_MAXHOST]; |
310 |
|
|
|
311 |
|
|
sa = (struct sockaddr *)(addr + 1); |
312 |
|
|
if (sa->sa_family == 0) |
313 |
|
|
printf("<any>"); |
314 |
|
|
else if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL, 0, |
315 |
|
|
NI_NUMERICHOST)) |
316 |
|
|
printf("<could not get numeric hostname>"); |
317 |
|
|
else |
318 |
|
|
printf("%s", hbuf); |
319 |
|
|
switch (sa->sa_family) { |
320 |
|
|
case AF_INET: |
321 |
|
|
sin4 = (struct sockaddr_in *)sa; |
322 |
|
|
if (sin4->sin_port) |
323 |
|
|
printf(" port %u", ntohs(sin4->sin_port)); |
324 |
|
|
break; |
325 |
|
|
case AF_INET6: |
326 |
|
|
sin6 = (struct sockaddr_in6 *)sa; |
327 |
|
|
if (sin6->sin6_port) |
328 |
|
|
printf(" port %u", ntohs(sin6->sin6_port)); |
329 |
|
|
break; |
330 |
|
|
} |
331 |
|
|
} |
332 |
|
|
|
333 |
|
|
/* ARGSUSED1 */ |
334 |
|
|
static void |
335 |
|
|
print_key(struct sadb_ext *ext, struct sadb_msg *msg) |
336 |
|
|
{ |
337 |
|
|
struct sadb_key *key = (struct sadb_key *)ext; |
338 |
|
|
u_int8_t *data; |
339 |
|
|
int i; |
340 |
|
|
|
341 |
|
|
printf("bits %u: ", key->sadb_key_bits); |
342 |
|
|
data = (u_int8_t *)(key + 1); |
343 |
|
|
for (i = 0; i < key->sadb_key_bits / 8; i++) { |
344 |
|
|
printf("%2.2x", data[i]); |
345 |
|
|
data[i] = 0x00; /* clear sensitive data */ |
346 |
|
|
} |
347 |
|
|
} |
348 |
|
|
|
349 |
|
|
/* ARGSUSED1 */ |
350 |
|
|
static void |
351 |
|
|
print_life(struct sadb_ext *ext, struct sadb_msg *msg) |
352 |
|
|
{ |
353 |
|
|
struct sadb_lifetime *life = (struct sadb_lifetime *)ext; |
354 |
|
|
|
355 |
|
|
printf("alloc %u bytes %llu add %llu first %llu", |
356 |
|
|
life->sadb_lifetime_allocations, |
357 |
|
|
life->sadb_lifetime_bytes, |
358 |
|
|
life->sadb_lifetime_addtime, |
359 |
|
|
life->sadb_lifetime_usetime); |
360 |
|
|
} |
361 |
|
|
|
362 |
|
|
static void |
363 |
|
|
print_proto(struct sadb_ext *ext, struct sadb_msg *msg) |
364 |
|
|
{ |
365 |
|
|
struct sadb_protocol *proto = (struct sadb_protocol *)ext; |
366 |
|
|
|
367 |
|
|
/* overloaded */ |
368 |
|
|
if (msg->sadb_msg_type == SADB_X_GRPSPIS) |
369 |
|
|
printf("satype %s flags %x", |
370 |
|
|
lookup_name(sa_types, proto->sadb_protocol_proto), |
371 |
|
|
proto->sadb_protocol_flags); |
372 |
|
|
else |
373 |
|
|
printf("proto %u flags %x", |
374 |
|
|
proto->sadb_protocol_proto, proto->sadb_protocol_flags); |
375 |
|
|
} |
376 |
|
|
|
377 |
|
|
/* ARGSUSED1 */ |
378 |
|
|
static void |
379 |
|
|
print_flow(struct sadb_ext *ext, struct sadb_msg *msg) |
380 |
|
|
{ |
381 |
|
|
struct sadb_protocol *proto = (struct sadb_protocol *)ext; |
382 |
|
|
char *dir = "unknown"; |
383 |
|
|
|
384 |
|
|
switch (proto->sadb_protocol_direction) { |
385 |
|
|
case IPSP_DIRECTION_IN: |
386 |
|
|
dir = "in"; |
387 |
|
|
break; |
388 |
|
|
case IPSP_DIRECTION_OUT: |
389 |
|
|
dir = "out"; |
390 |
|
|
break; |
391 |
|
|
} |
392 |
|
|
printf("type %s direction %s", |
393 |
|
|
lookup_name(flow_types, proto->sadb_protocol_proto), dir); |
394 |
|
|
} |
395 |
|
|
|
396 |
|
|
static void |
397 |
|
|
print_tag(struct sadb_ext *ext, struct sadb_msg *msg) |
398 |
|
|
{ |
399 |
|
|
struct sadb_x_tag *stag = (struct sadb_x_tag *)ext; |
400 |
|
|
char *p; |
401 |
|
|
|
402 |
|
|
p = (char *)(stag + 1); |
403 |
|
|
printf("%s", p); |
404 |
|
|
} |
405 |
|
|
|
406 |
|
|
static void |
407 |
|
|
print_tap(struct sadb_ext *ext, struct sadb_msg *msg) |
408 |
|
|
{ |
409 |
|
|
struct sadb_x_tap *stap = (struct sadb_x_tap *)ext; |
410 |
|
|
|
411 |
|
|
printf("enc%u", stap->sadb_x_tap_unit); |
412 |
|
|
} |
413 |
|
|
|
414 |
|
|
static void |
415 |
|
|
print_satype(struct sadb_ext *ext, struct sadb_msg *msg) |
416 |
|
|
{ |
417 |
|
|
struct sadb_protocol *proto = (struct sadb_protocol *)ext; |
418 |
|
|
|
419 |
|
|
printf("type %s", lookup_name(sa_types, proto->sadb_protocol_proto)); |
420 |
|
|
} |
421 |
|
|
|
422 |
|
|
static char * |
423 |
|
|
alg_by_ext(u_int8_t ext_type, u_int8_t id) |
424 |
|
|
{ |
425 |
|
|
switch (ext_type) { |
426 |
|
|
case SADB_EXT_SUPPORTED_ENCRYPT: |
427 |
|
|
return lookup_name(enc_types, id); |
428 |
|
|
case SADB_EXT_SUPPORTED_AUTH: |
429 |
|
|
return lookup_name(auth_types, id); |
430 |
|
|
case SADB_X_EXT_SUPPORTED_COMP: |
431 |
|
|
return lookup_name(comp_types, id); |
432 |
|
|
default: |
433 |
|
|
return "unknown"; |
434 |
|
|
} |
435 |
|
|
} |
436 |
|
|
|
437 |
|
|
static void |
438 |
|
|
print_alg(struct sadb_alg *alg, u_int8_t ext_type) |
439 |
|
|
{ |
440 |
|
|
printf("\t\t%s iv %u min %u max %u", |
441 |
|
|
alg_by_ext(ext_type, alg->sadb_alg_id), alg->sadb_alg_ivlen, |
442 |
|
|
alg->sadb_alg_minbits, alg->sadb_alg_maxbits); |
443 |
|
|
} |
444 |
|
|
|
445 |
|
|
/* ARGSUSED1 */ |
446 |
|
|
static void |
447 |
|
|
print_supp(struct sadb_ext *ext, struct sadb_msg *msg) |
448 |
|
|
{ |
449 |
|
|
struct sadb_supported *supported = (struct sadb_supported *)ext; |
450 |
|
|
struct sadb_alg *alg; |
451 |
|
|
|
452 |
|
|
printf("\n"); |
453 |
|
|
for (alg = (struct sadb_alg *)(supported + 1); |
454 |
|
|
(size_t)((u_int8_t *)alg - (u_int8_t *)ext) < |
455 |
|
|
ext->sadb_ext_len * PFKEYV2_CHUNK; |
456 |
|
|
alg++) { |
457 |
|
|
struct sadb_alg *next = alg + 1; |
458 |
|
|
print_alg(alg, ext->sadb_ext_type); |
459 |
|
|
if ((size_t)((u_int8_t *)next - (u_int8_t *)ext) < |
460 |
|
|
ext->sadb_ext_len * PFKEYV2_CHUNK) |
461 |
|
|
printf("\n"); |
462 |
|
|
} |
463 |
|
|
} |
464 |
|
|
|
465 |
|
|
/* ARGSUSED1 */ |
466 |
|
|
static void |
467 |
|
|
print_comb(struct sadb_comb *comb, struct sadb_msg *msg) |
468 |
|
|
{ |
469 |
|
|
printf("\t\tauth %s min %u max %u\n" |
470 |
|
|
"\t\tenc %s min %u max %u\n" |
471 |
|
|
"\t\taddtime hard %llu soft %llu\n" |
472 |
|
|
"\t\tusetime hard %llu soft %llu", |
473 |
|
|
lookup_name(auth_types, comb->sadb_comb_auth), |
474 |
|
|
comb->sadb_comb_auth_minbits, |
475 |
|
|
comb->sadb_comb_auth_maxbits, |
476 |
|
|
lookup_name(enc_types, comb->sadb_comb_encrypt), |
477 |
|
|
comb->sadb_comb_encrypt_minbits, |
478 |
|
|
comb->sadb_comb_encrypt_maxbits, |
479 |
|
|
comb->sadb_comb_soft_addtime, |
480 |
|
|
comb->sadb_comb_hard_addtime, |
481 |
|
|
comb->sadb_comb_soft_usetime, |
482 |
|
|
comb->sadb_comb_hard_usetime); |
483 |
|
|
#if 0 |
484 |
|
|
comb->sadb_comb_flags, |
485 |
|
|
comb->sadb_comb_reserved, |
486 |
|
|
comb->sadb_comb_soft_allocations, |
487 |
|
|
comb->sadb_comb_hard_allocations, |
488 |
|
|
comb->sadb_comb_soft_bytes, |
489 |
|
|
comb->sadb_comb_hard_bytes, |
490 |
|
|
#endif |
491 |
|
|
} |
492 |
|
|
|
493 |
|
|
/* ARGSUSED1 */ |
494 |
|
|
static void |
495 |
|
|
print_prop(struct sadb_ext *ext, struct sadb_msg *msg) |
496 |
|
|
{ |
497 |
|
|
struct sadb_prop *prop = (struct sadb_prop *)ext; |
498 |
|
|
struct sadb_comb *comb; |
499 |
|
|
|
500 |
|
|
printf("replay %u\n", prop->sadb_prop_replay); |
501 |
|
|
for (comb = (struct sadb_comb *)(prop + 1); |
502 |
|
|
(size_t)((u_int8_t *)comb - (u_int8_t *)ext) < |
503 |
|
|
ext->sadb_ext_len * PFKEYV2_CHUNK; |
504 |
|
|
comb++) |
505 |
|
|
print_comb(comb, msg); |
506 |
|
|
} |
507 |
|
|
|
508 |
|
|
/* ARGSUSED1 */ |
509 |
|
|
static void |
510 |
|
|
print_sens(struct sadb_ext *ext, struct sadb_msg *msg) |
511 |
|
|
{ |
512 |
|
|
struct sadb_sens *sens = (struct sadb_sens *)ext; |
513 |
|
|
|
514 |
|
|
printf("dpd %u sens_level %u integ_level %u", |
515 |
|
|
sens->sadb_sens_dpd, |
516 |
|
|
sens->sadb_sens_sens_level, |
517 |
|
|
sens->sadb_sens_integ_level); |
518 |
|
|
} |
519 |
|
|
|
520 |
|
|
/* ARGSUSED1 */ |
521 |
|
|
static void |
522 |
|
|
print_spir(struct sadb_ext *ext, struct sadb_msg *msg) |
523 |
|
|
{ |
524 |
|
|
struct sadb_spirange *spirange = (struct sadb_spirange *)ext; |
525 |
|
|
|
526 |
|
|
printf("min 0x%8.8x max 0x%8.8x", |
527 |
|
|
spirange->sadb_spirange_min, spirange->sadb_spirange_max); |
528 |
|
|
} |
529 |
|
|
|
530 |
|
|
/* ARGSUSED1 */ |
531 |
|
|
static void |
532 |
|
|
print_ident(struct sadb_ext *ext, struct sadb_msg *msg) |
533 |
|
|
{ |
534 |
|
|
struct sadb_ident *ident = (struct sadb_ident *)ext; |
535 |
|
|
|
536 |
|
|
printf("type %s id %llu: %s", |
537 |
|
|
lookup_name(identity_types, ident->sadb_ident_type), |
538 |
|
|
ident->sadb_ident_id, (char *)(ident + 1)); |
539 |
|
|
} |
540 |
|
|
|
541 |
|
|
/* ARGSUSED1 */ |
542 |
|
|
static void |
543 |
|
|
print_policy(struct sadb_ext *ext, struct sadb_msg *msg) |
544 |
|
|
{ |
545 |
|
|
struct sadb_x_policy *x_policy = (struct sadb_x_policy *)ext; |
546 |
|
|
|
547 |
|
|
printf("seq %u", x_policy->sadb_x_policy_seq); |
548 |
|
|
} |
549 |
|
|
|
550 |
|
|
/* ARGSUSED1 */ |
551 |
|
|
static void |
552 |
|
|
print_udpenc(struct sadb_ext *ext, struct sadb_msg *msg) |
553 |
|
|
{ |
554 |
|
|
struct sadb_x_udpencap *x_udpencap = (struct sadb_x_udpencap *)ext; |
555 |
|
|
|
556 |
|
|
printf("udpencap port %u", ntohs(x_udpencap->sadb_x_udpencap_port)); |
557 |
|
|
} |
558 |
|
|
|
559 |
|
|
static void |
560 |
|
|
setup_extensions(struct sadb_msg *msg) |
561 |
|
|
{ |
562 |
|
|
struct sadb_ext *ext; |
563 |
|
|
|
564 |
|
|
bzero(extensions, sizeof(extensions)); |
565 |
|
|
if (msg->sadb_msg_len == 0) |
566 |
|
|
return; |
567 |
|
|
for (ext = (struct sadb_ext *)(msg + 1); |
568 |
|
|
(size_t)((u_int8_t *)ext - (u_int8_t *)msg) < |
569 |
|
|
msg->sadb_msg_len * PFKEYV2_CHUNK && ext->sadb_ext_len > 0; |
570 |
|
|
ext = (struct sadb_ext *)((u_int8_t *)ext + |
571 |
|
|
ext->sadb_ext_len * PFKEYV2_CHUNK)) |
572 |
|
|
extensions[ext->sadb_ext_type] = ext; |
573 |
|
|
} |
574 |
|
|
|
575 |
|
|
static void |
576 |
|
|
parse_addr(struct sadb_ext *ext, struct ipsec_addr_wrap *ipa) |
577 |
|
|
{ |
578 |
|
|
struct sadb_address *addr = (struct sadb_address *)ext; |
579 |
|
|
struct sockaddr *sa; |
580 |
|
|
|
581 |
|
|
if (addr == NULL) |
582 |
|
|
return; |
583 |
|
|
sa = (struct sockaddr *)(addr + 1); |
584 |
|
|
switch (sa->sa_family) { |
585 |
|
|
case AF_INET: |
586 |
|
|
ipa->address.v4 = ((struct sockaddr_in *)sa)->sin_addr; |
587 |
|
|
set_ipmask(ipa, 32); |
588 |
|
|
break; |
589 |
|
|
case AF_INET6: |
590 |
|
|
ipa->address.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; |
591 |
|
|
set_ipmask(ipa, 128); |
592 |
|
|
break; |
593 |
|
|
} |
594 |
|
|
ipa->af = sa->sa_family; |
595 |
|
|
ipa->next = NULL; |
596 |
|
|
ipa->tail = ipa; |
597 |
|
|
} |
598 |
|
|
|
599 |
|
|
static void |
600 |
|
|
parse_key(struct sadb_ext *ext, struct ipsec_key *ikey) |
601 |
|
|
{ |
602 |
|
|
struct sadb_key *key = (struct sadb_key *)ext; |
603 |
|
|
u_int8_t *data; |
604 |
|
|
|
605 |
|
|
if (key == NULL) |
606 |
|
|
return; |
607 |
|
|
data = (u_int8_t *)(key + 1); |
608 |
|
|
ikey->data = data; |
609 |
|
|
ikey->len = key->sadb_key_bits / 8; |
610 |
|
|
} |
611 |
|
|
|
612 |
|
|
static void |
613 |
|
|
parse_satype(struct sadb_ext *ext, u_int8_t *satype) |
614 |
|
|
{ |
615 |
|
|
struct sadb_protocol *proto = (struct sadb_protocol *)ext; |
616 |
|
|
|
617 |
|
|
if (proto == NULL) |
618 |
|
|
return; |
619 |
|
|
switch (proto->sadb_protocol_proto) { |
620 |
|
|
case SADB_SATYPE_ESP: |
621 |
|
|
*satype = IPSEC_ESP; |
622 |
|
|
break; |
623 |
|
|
case SADB_SATYPE_AH: |
624 |
|
|
*satype = IPSEC_AH; |
625 |
|
|
break; |
626 |
|
|
case SADB_X_SATYPE_IPCOMP: |
627 |
|
|
*satype = IPSEC_IPCOMP; |
628 |
|
|
break; |
629 |
|
|
case SADB_X_SATYPE_IPIP: |
630 |
|
|
*satype = IPSEC_IPIP; |
631 |
|
|
break; |
632 |
|
|
default: |
633 |
|
|
return; |
634 |
|
|
} |
635 |
|
|
} |
636 |
|
|
|
637 |
|
|
u_int32_t |
638 |
|
|
pfkey_get_spi(struct sadb_msg *msg) |
639 |
|
|
{ |
640 |
|
|
struct sadb_sa *sa; |
641 |
|
|
|
642 |
|
|
setup_extensions(msg); |
643 |
|
|
sa = (struct sadb_sa *)extensions[SADB_EXT_SA]; |
644 |
|
|
return (ntohl(sa->sadb_sa_spi)); |
645 |
|
|
} |
646 |
|
|
|
647 |
|
|
/* opposite of pfkey_sa() */ |
648 |
|
|
void |
649 |
|
|
pfkey_print_sa(struct sadb_msg *msg, int opts) |
650 |
|
|
{ |
651 |
|
|
int i; |
652 |
|
|
struct ipsec_rule r; |
653 |
|
|
struct ipsec_key enckey, authkey; |
654 |
|
|
struct ipsec_transforms xfs; |
655 |
|
|
struct ipsec_addr_wrap src, dst, dst2; |
656 |
|
|
struct sadb_sa *sa, *sa2; |
657 |
|
|
|
658 |
|
|
setup_extensions(msg); |
659 |
|
|
sa = (struct sadb_sa *)extensions[SADB_EXT_SA]; |
660 |
|
|
bzero(&r, sizeof r); |
661 |
|
|
r.type |= RULE_SA; |
662 |
|
|
r.tmode = (msg->sadb_msg_satype != SADB_X_SATYPE_TCPSIGNATURE) && |
663 |
|
|
(sa->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL) ? |
664 |
|
|
IPSEC_TUNNEL : IPSEC_TRANSPORT; |
665 |
|
|
r.spi = ntohl(sa->sadb_sa_spi); |
666 |
|
|
|
667 |
|
|
switch (msg->sadb_msg_satype) { |
668 |
|
|
case SADB_SATYPE_AH: |
669 |
|
|
r.satype = IPSEC_AH; |
670 |
|
|
break; |
671 |
|
|
case SADB_SATYPE_ESP: |
672 |
|
|
r.satype = IPSEC_ESP; |
673 |
|
|
break; |
674 |
|
|
case SADB_X_SATYPE_IPCOMP: |
675 |
|
|
r.satype = IPSEC_IPCOMP; |
676 |
|
|
break; |
677 |
|
|
case SADB_X_SATYPE_TCPSIGNATURE: |
678 |
|
|
r.satype = IPSEC_TCPMD5; |
679 |
|
|
break; |
680 |
|
|
case SADB_X_SATYPE_IPIP: |
681 |
|
|
r.satype = IPSEC_IPIP; |
682 |
|
|
break; |
683 |
|
|
default: |
684 |
|
|
return; |
685 |
|
|
} |
686 |
|
|
bzero(&dst, sizeof dst); |
687 |
|
|
bzero(&src, sizeof src); |
688 |
|
|
parse_addr(extensions[SADB_EXT_ADDRESS_SRC], &src); |
689 |
|
|
parse_addr(extensions[SADB_EXT_ADDRESS_DST], &dst); |
690 |
|
|
r.src = &src; |
691 |
|
|
r.dst = &dst; |
692 |
|
|
if (r.satype == IPSEC_IPCOMP) { |
693 |
|
|
if (sa->sadb_sa_encrypt) { |
694 |
|
|
bzero(&xfs, sizeof xfs); |
695 |
|
|
r.xfs = &xfs; |
696 |
|
|
switch (sa->sadb_sa_encrypt) { |
697 |
|
|
case SADB_X_CALG_DEFLATE: |
698 |
|
|
xfs.compxf = &compxfs[COMPXF_DEFLATE]; |
699 |
|
|
break; |
700 |
|
|
case SADB_X_CALG_LZS: |
701 |
|
|
xfs.compxf = &compxfs[COMPXF_LZS]; |
702 |
|
|
break; |
703 |
|
|
} |
704 |
|
|
} |
705 |
|
|
} else if (r.satype == IPSEC_TCPMD5) { |
706 |
|
|
bzero(&authkey, sizeof authkey); |
707 |
|
|
parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey); |
708 |
|
|
r.authkey = &authkey; |
709 |
|
|
} else if (sa->sadb_sa_encrypt || sa->sadb_sa_auth) { |
710 |
|
|
bzero(&xfs, sizeof xfs); |
711 |
|
|
r.xfs = &xfs; |
712 |
|
|
if (sa->sadb_sa_encrypt) { |
713 |
|
|
bzero(&enckey, sizeof enckey); |
714 |
|
|
parse_key(extensions[SADB_EXT_KEY_ENCRYPT], &enckey); |
715 |
|
|
r.enckey = &enckey; |
716 |
|
|
|
717 |
|
|
switch (sa->sadb_sa_encrypt) { |
718 |
|
|
case SADB_EALG_3DESCBC: |
719 |
|
|
xfs.encxf = &encxfs[ENCXF_3DES_CBC]; |
720 |
|
|
break; |
721 |
|
|
case SADB_X_EALG_AES: |
722 |
|
|
switch (r.enckey->len) { |
723 |
|
|
case 192/8: |
724 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_192]; |
725 |
|
|
break; |
726 |
|
|
case 256/8: |
727 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_256]; |
728 |
|
|
break; |
729 |
|
|
default: |
730 |
|
|
xfs.encxf = &encxfs[ENCXF_AES]; |
731 |
|
|
break; |
732 |
|
|
} |
733 |
|
|
break; |
734 |
|
|
case SADB_X_EALG_AESCTR: |
735 |
|
|
switch (r.enckey->len) { |
736 |
|
|
case 28: |
737 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_192_CTR]; |
738 |
|
|
break; |
739 |
|
|
case 36: |
740 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_256_CTR]; |
741 |
|
|
break; |
742 |
|
|
default: |
743 |
|
|
xfs.encxf = &encxfs[ENCXF_AESCTR]; |
744 |
|
|
break; |
745 |
|
|
} |
746 |
|
|
break; |
747 |
|
|
case SADB_X_EALG_AESGCM16: |
748 |
|
|
switch (r.enckey->len) { |
749 |
|
|
case 28: |
750 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_192_GCM]; |
751 |
|
|
break; |
752 |
|
|
case 36: |
753 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_256_GCM]; |
754 |
|
|
break; |
755 |
|
|
default: |
756 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_128_GCM]; |
757 |
|
|
break; |
758 |
|
|
} |
759 |
|
|
break; |
760 |
|
|
case SADB_X_EALG_AESGMAC: |
761 |
|
|
switch (r.enckey->len) { |
762 |
|
|
case 28: |
763 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_192_GMAC]; |
764 |
|
|
break; |
765 |
|
|
case 36: |
766 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_256_GMAC]; |
767 |
|
|
break; |
768 |
|
|
default: |
769 |
|
|
xfs.encxf = &encxfs[ENCXF_AES_128_GMAC]; |
770 |
|
|
break; |
771 |
|
|
} |
772 |
|
|
break; |
773 |
|
|
case SADB_X_EALG_BLF: |
774 |
|
|
xfs.encxf = &encxfs[ENCXF_BLOWFISH]; |
775 |
|
|
break; |
776 |
|
|
case SADB_X_EALG_CAST: |
777 |
|
|
xfs.encxf = &encxfs[ENCXF_CAST128]; |
778 |
|
|
break; |
779 |
|
|
case SADB_X_EALG_CHACHA20POLY1305: |
780 |
|
|
xfs.encxf = &encxfs[ENCXF_CHACHA20_POLY1305]; |
781 |
|
|
break; |
782 |
|
|
case SADB_EALG_NULL: |
783 |
|
|
xfs.encxf = &encxfs[ENCXF_NULL]; |
784 |
|
|
break; |
785 |
|
|
} |
786 |
|
|
} |
787 |
|
|
if (sa->sadb_sa_auth) { |
788 |
|
|
bzero(&authkey, sizeof authkey); |
789 |
|
|
parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey); |
790 |
|
|
r.authkey = &authkey; |
791 |
|
|
|
792 |
|
|
switch (sa->sadb_sa_auth) { |
793 |
|
|
case SADB_AALG_MD5HMAC: |
794 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_MD5]; |
795 |
|
|
break; |
796 |
|
|
case SADB_X_AALG_RIPEMD160HMAC: |
797 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_RIPEMD160]; |
798 |
|
|
break; |
799 |
|
|
case SADB_AALG_SHA1HMAC: |
800 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA1]; |
801 |
|
|
break; |
802 |
|
|
case SADB_X_AALG_SHA2_256: |
803 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_256]; |
804 |
|
|
break; |
805 |
|
|
case SADB_X_AALG_SHA2_384: |
806 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_384]; |
807 |
|
|
break; |
808 |
|
|
case SADB_X_AALG_SHA2_512: |
809 |
|
|
xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_512]; |
810 |
|
|
break; |
811 |
|
|
} |
812 |
|
|
} |
813 |
|
|
} |
814 |
|
|
if (!(opts & IPSECCTL_OPT_SHOWKEY)) { |
815 |
|
|
bzero(&enckey, sizeof enckey); |
816 |
|
|
bzero(&authkey, sizeof authkey); |
817 |
|
|
extensions[SADB_EXT_KEY_AUTH] = NULL; |
818 |
|
|
extensions[SADB_EXT_KEY_ENCRYPT] = NULL; |
819 |
|
|
} |
820 |
|
|
if (extensions[SADB_X_EXT_SA2]) { |
821 |
|
|
r.type |= RULE_BUNDLE; |
822 |
|
|
sa2 = (struct sadb_sa *)extensions[SADB_X_EXT_SA2]; |
823 |
|
|
r.spi2 = ntohl(sa2->sadb_sa_spi); |
824 |
|
|
parse_addr(extensions[SADB_X_EXT_DST2], &dst2); |
825 |
|
|
r.dst2 = &dst2; |
826 |
|
|
parse_satype(extensions[SADB_X_EXT_SATYPE2], &r.proto2); |
827 |
|
|
r.proto = r.satype; |
828 |
|
|
} |
829 |
|
|
ipsecctl_print_rule(&r, opts); |
830 |
|
|
|
831 |
|
|
if (opts & IPSECCTL_OPT_VERBOSE) { |
832 |
|
|
for (i = 0; i <= SADB_EXT_MAX; i++) |
833 |
|
|
if (extensions[i]) |
834 |
|
|
print_ext(extensions[i], msg); |
835 |
|
|
} |
836 |
|
|
fflush(stdout); |
837 |
|
|
} |
838 |
|
|
|
839 |
|
|
/* ARGSUSED1 */ |
840 |
|
|
void |
841 |
|
|
pfkey_monitor_sa(struct sadb_msg *msg, int opts) |
842 |
|
|
{ |
843 |
|
|
int i; |
844 |
|
|
|
845 |
|
|
setup_extensions(msg); |
846 |
|
|
|
847 |
|
|
printf("%s: satype %s vers %u len %u seq %u pid %u\n", |
848 |
|
|
lookup_name(msg_types, msg->sadb_msg_type), |
849 |
|
|
lookup_name(sa_types, msg->sadb_msg_satype), |
850 |
|
|
msg->sadb_msg_version, msg->sadb_msg_len, |
851 |
|
|
msg->sadb_msg_seq, |
852 |
|
|
msg->sadb_msg_pid); |
853 |
|
|
if (msg->sadb_msg_errno) |
854 |
|
|
printf("\terrno %u: %s\n", msg->sadb_msg_errno, |
855 |
|
|
strerror(msg->sadb_msg_errno)); |
856 |
|
|
for (i = 0; i <= SADB_EXT_MAX; i++) |
857 |
|
|
if (extensions[i]) |
858 |
|
|
print_ext(extensions[i], msg); |
859 |
|
|
fflush(stdout); |
860 |
|
|
} |
861 |
|
|
|
862 |
|
|
void |
863 |
|
|
pfkey_print_raw(u_int8_t *data, ssize_t len) |
864 |
|
|
{ |
865 |
|
|
int i; |
866 |
|
|
const u_int8_t *sp = (const u_int8_t *)data; |
867 |
|
|
|
868 |
|
|
printf("RAW PFKEYV2 MESSAGE:\n"); |
869 |
|
|
for (i = 0; i < len; i++) { |
870 |
|
|
if ((i % 8 == 0) && (i != 0)) |
871 |
|
|
printf("\n"); |
872 |
|
|
printf("%02x ", *sp); |
873 |
|
|
sp++; |
874 |
|
|
} |
875 |
|
|
printf("\n"); |
876 |
|
|
} |